Analysis
- max time kernel
147s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
13/10/2024, 15:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
40bb6743852c4b27692e9124652d9f08_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
40bb6743852c4b27692e9124652d9f08_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 40bb6743852c4b27692e9124652d9f08_JaffaCakes118.exe
- Size 108KB
- Sample241013-tbjpwsvare
- SHA256 e0807e70949fe1ac4f55208c3f2a67a1b5f64d83e765c7cf16781bf5a12960f4
- MD5 40bb6743852c4b27692e9124652d9f08
- SHA1 bf9562b4994e8e211951f21a3179114efa663c6a
- SHA512 efed7bae2422d0528b1907547ff7078c6a6edd89e3db786bd6ce9261b520410f8a21b71ff8b0906fc98cc13f5ddb062f4b889a59a479c2bd77d8fbf46d3ee8a5
- SSDEEP 3072:AxCuqnzsUkYrPHl5dBONYIoriXIrKfiHpI61Fxwx:Ax/YrLdBONYH+IrK0I61
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Possible privilege escalation attempt 2 IoCs
pid Process 4024 takeown.exe 1664 icacls.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 40bb6743852c4b27692e9124652d9f08_JaffaCakes118.exe - Deletes itself 1 IoCs
pid Process 3020 regsvr32.exe - Loads dropped DLL 1 IoCs
pid Process 3020 regsvr32.exe - Modifies file permissions 1 TTPs 2 IoCs
pid Process 4024 takeown.exe 1664 icacls.exe - File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rpcss.dll regsvr32.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 svchost.exe File opened for modification C:\Windows\SysWOW64\apa.dll regsvr32.exe File created C:\Windows\SysWOW64\rpcss.dll regsvr32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language takeown.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40bb6743852c4b27692e9124652d9f08_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies data under HKEY_USERS 49 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption" svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates svchost.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI svchost.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133733084143559223" svchost.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI svchost.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI svchost.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\ICT = "133727674054230764" svchost.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy svchost.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133733084141059314" svchost.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133733083810612685" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133733083853559355" svchost.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU svchost.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\PCT = "133727674052043354" svchost.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3020 regsvr32.exe 3020 regsvr32.exe 3020 regsvr32.exe 3020 regsvr32.exe 3020 regsvr32.exe 3020 regsvr32.exe 3020 regsvr32.exe 3020 regsvr32.exe 3020 regsvr32.exe 3020 regsvr32.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3020 regsvr32.exe Token: SeTakeOwnershipPrivilege 4024 takeown.exe Token: SeAssignPrimaryTokenPrivilege 2248 svchost.exe Token: SeIncreaseQuotaPrivilege 2248 svchost.exe Token: SeSecurityPrivilege 2248 svchost.exe Token: SeTakeOwnershipPrivilege 2248 svchost.exe Token: SeLoadDriverPrivilege 2248 svchost.exe Token: SeSystemtimePrivilege 2248 svchost.exe Token: SeBackupPrivilege 2248 svchost.exe Token: SeRestorePrivilege 2248 svchost.exe Token: SeShutdownPrivilege 2248 svchost.exe Token: SeSystemEnvironmentPrivilege 2248 svchost.exe Token: SeUndockPrivilege 2248 svchost.exe Token: SeManageVolumePrivilege 2248 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2248 svchost.exe Token: SeIncreaseQuotaPrivilege 2248 svchost.exe Token: SeSecurityPrivilege 2248 svchost.exe Token: SeTakeOwnershipPrivilege 2248 svchost.exe Token: SeLoadDriverPrivilege 2248 svchost.exe Token: SeSystemtimePrivilege 2248 svchost.exe Token: SeBackupPrivilege 2248 svchost.exe Token: SeRestorePrivilege 2248 svchost.exe Token: SeShutdownPrivilege 2248 svchost.exe Token: SeSystemEnvironmentPrivilege 2248 svchost.exe Token: SeUndockPrivilege 2248 svchost.exe Token: SeManageVolumePrivilege 2248 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2248 svchost.exe Token: SeIncreaseQuotaPrivilege 2248 svchost.exe Token: SeSecurityPrivilege 2248 svchost.exe Token: SeTakeOwnershipPrivilege 2248 svchost.exe Token: SeLoadDriverPrivilege 2248 svchost.exe Token: SeSystemtimePrivilege 2248 svchost.exe Token: SeBackupPrivilege 2248 svchost.exe Token: SeRestorePrivilege 2248 svchost.exe Token: SeShutdownPrivilege 2248 svchost.exe Token: SeSystemEnvironmentPrivilege 2248 svchost.exe Token: SeUndockPrivilege 2248 svchost.exe Token: SeManageVolumePrivilege 2248 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2248 svchost.exe Token: SeIncreaseQuotaPrivilege 2248 svchost.exe Token: SeSecurityPrivilege 2248 svchost.exe Token: SeTakeOwnershipPrivilege 2248 svchost.exe Token: SeLoadDriverPrivilege 2248 svchost.exe Token: SeSystemtimePrivilege 2248 svchost.exe Token: SeBackupPrivilege 2248 svchost.exe Token: SeRestorePrivilege 2248 svchost.exe Token: SeShutdownPrivilege 2248 svchost.exe Token: SeSystemEnvironmentPrivilege 2248 svchost.exe Token: SeUndockPrivilege 2248 svchost.exe Token: SeManageVolumePrivilege 2248 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2248 svchost.exe Token: SeIncreaseQuotaPrivilege 2248 svchost.exe Token: SeSecurityPrivilege 2248 svchost.exe Token: SeTakeOwnershipPrivilege 2248 svchost.exe Token: SeLoadDriverPrivilege 2248 svchost.exe Token: SeSystemtimePrivilege 2248 svchost.exe Token: SeBackupPrivilege 2248 svchost.exe Token: SeRestorePrivilege 2248 svchost.exe Token: SeShutdownPrivilege 2248 svchost.exe Token: SeSystemEnvironmentPrivilege 2248 svchost.exe Token: SeUndockPrivilege 2248 svchost.exe Token: SeManageVolumePrivilege 2248 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2248 svchost.exe Token: SeIncreaseQuotaPrivilege 2248 svchost.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2260 wrote to memory of 3020 2260 40bb6743852c4b27692e9124652d9f08_JaffaCakes118.exe 86 PID 2260 wrote to memory of 3020 2260 40bb6743852c4b27692e9124652d9f08_JaffaCakes118.exe 86 PID 2260 wrote to memory of 3020 2260 40bb6743852c4b27692e9124652d9f08_JaffaCakes118.exe 86 PID 3020 wrote to memory of 4024 3020 regsvr32.exe 87 PID 3020 wrote to memory of 4024 3020 regsvr32.exe 87 PID 3020 wrote to memory of 4024 3020 regsvr32.exe 87 PID 3020 wrote to memory of 1664 3020 regsvr32.exe 89 PID 3020 wrote to memory of 1664 3020 regsvr32.exe 89 PID 3020 wrote to memory of 1664 3020 regsvr32.exe 89 PID 3020 wrote to memory of 784 3020 regsvr32.exe 10 PID 3020 wrote to memory of 784 3020 regsvr32.exe 10 PID 3020 wrote to memory of 900 3020 regsvr32.exe 11 PID 3020 wrote to memory of 900 3020 regsvr32.exe 11 PID 3020 wrote to memory of 944 3020 regsvr32.exe 12 PID 3020 wrote to memory of 944 3020 regsvr32.exe 12 PID 3020 wrote to memory of 732 3020 regsvr32.exe 14 PID 3020 wrote to memory of 732 3020 regsvr32.exe 14 PID 3020 wrote to memory of 1028 3020 regsvr32.exe 15 PID 3020 wrote to memory of 1028 3020 regsvr32.exe 15 PID 3020 wrote to memory of 1036 3020 regsvr32.exe 16 PID 3020 wrote to memory of 1036 3020 regsvr32.exe 16 PID 3020 wrote to memory of 1044 3020 regsvr32.exe 17 PID 3020 wrote to memory of 1044 3020 regsvr32.exe 17 PID 3020 wrote to memory of 1112 3020 regsvr32.exe 18 PID 3020 wrote to memory of 1112 3020 regsvr32.exe 18 PID 3020 wrote to memory of 1220 3020 regsvr32.exe 19 PID 3020 wrote to memory of 1220 3020 regsvr32.exe 19 PID 3020 wrote to memory of 1228 3020 regsvr32.exe 20 PID 3020 wrote to memory of 1228 3020 regsvr32.exe 20 PID 3020 wrote to memory of 1292 3020 regsvr32.exe 21 PID 3020 wrote to memory of 1292 3020 regsvr32.exe 21 PID 3020 wrote to memory of 1360 3020 regsvr32.exe 22 PID 3020 wrote to memory of 1360 3020 regsvr32.exe 22 PID 3020 wrote to memory of 1396 3020 regsvr32.exe 23 PID 3020 wrote to memory of 1396 3020 regsvr32.exe 23 PID 3020 wrote to memory of 1444 3020 regsvr32.exe 24 PID 3020 wrote to memory of 1444 3020 regsvr32.exe 24 PID 3020 wrote to memory of 1472 3020 regsvr32.exe 25 PID 3020 wrote to memory of 1472 3020 regsvr32.exe 25 PID 3020 wrote to memory of 1488 3020 regsvr32.exe 26 PID 3020 wrote to memory of 1488 3020 regsvr32.exe 26 PID 3020 wrote to memory of 1568 3020 regsvr32.exe 27 PID 3020 wrote to memory of 1568 3020 regsvr32.exe 27 PID 3020 wrote to memory of 1632 3020 regsvr32.exe 28 PID 3020 wrote to memory of 1632 3020 regsvr32.exe 28 PID 3020 wrote to memory of 1688 3020 regsvr32.exe 29 PID 3020 wrote to memory of 1688 3020 regsvr32.exe 29 PID 3020 wrote to memory of 1704 3020 regsvr32.exe 30 PID 3020 wrote to memory of 1704 3020 regsvr32.exe 30 PID 3020 wrote to memory of 1800 3020 regsvr32.exe 31 PID 3020 wrote to memory of 1800 3020 regsvr32.exe 31 PID 3020 wrote to memory of 1840 3020 regsvr32.exe 32 PID 3020 wrote to memory of 1840 3020 regsvr32.exe 32 PID 3020 wrote to memory of 1900 3020 regsvr32.exe 33 PID 3020 wrote to memory of 1900 3020 regsvr32.exe 33 PID 3020 wrote to memory of 1908 3020 regsvr32.exe 34 PID 3020 wrote to memory of 1908 3020 regsvr32.exe 34 PID 3020 wrote to memory of 1964 3020 regsvr32.exe 35 PID 3020 wrote to memory of 1964 3020 regsvr32.exe 35 PID 3020 wrote to memory of 1356 3020 regsvr32.exe 36 PID 3020 wrote to memory of 1356 3020 regsvr32.exe 36 PID 3020 wrote to memory of 2088 3020 regsvr32.exe 38 PID 3020 wrote to memory of 2088 3020 regsvr32.exe 38 PID 3020 wrote to memory of 2156 3020 regsvr32.exe 39
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
- Modifies registry class
PID:784 -
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding2⤵PID:628
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:3112
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:900
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:944
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:732
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:1028
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1036
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:1044
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1112
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1220
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1228
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1292
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1360
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1396
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1444
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1472
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1488
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1568
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1632
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1688
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1704
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1800
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1840
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1900
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1908
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1964
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1356
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2088
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2156
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2272
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2416
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2424
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2580
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2720
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2792
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2852
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2860
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:2876
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3372
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3608
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:4964
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:4420
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:728
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
PID:3860
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:2692
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\40bb6743852c4b27692e9124652d9f08_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\40bb6743852c4b27692e9124652d9f08_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s C:\Users\Admin\AppData\Local\Temp\e579a2d~.tmp ,C:\Users\Admin\AppData\Local\Temp\40bb6743852c4b27692e9124652d9f08_JaffaCakes118.exe2⤵
- Deletes itself
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\system32\rpcss.dll"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4024
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\system32\rpcss.dll" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:1664
-
-
C:\Windows\SysWOW64\cmd.execmd /c del %SystemRoot%\system32\rpcss.dll~*3⤵
- System Location Discovery: System Language Discovery
PID:2808
-
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Indicator Removal
1File Deletion
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
- Size 338B
- SHA256 8b3f2466def2d01886003465c9bb7ae500d656d8862e11934535ca49a5a6f465
- MD5 174c9fdd1e28e1ffb757de48d7923e54
- SHA1 60995408184671700d8a471d0a9588aee559f01f
- SHA512 fce6c371de4fb63a8bb0a3c0ffa5185a76d74b4992531872433e4519e7b78fe13238c0465ecc77f00d2251d0347f15e0b619151abf9eed2865687438d5f66d56
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 404B
- SHA256 1e239e5d42a8b6a4fdf99644409639e593766196e90199143cf8443b314e6422
- MD5 79f88ac46a558df57bd4991991523bb5
- SHA1 550b7b5ada4151df1390b0cb9b7db05c2b1243b4
- SHA512 c1b73da399dbbbe1e46a228b34660dba37238cf989cdc88c19443b0c21cb2227bba4d59d5751f3cc32b02c541752ff07d2bb7bd76dd9ab36c2b58dea63483a51
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\e579a2d~.tmp
- Size 915KB
- SHA256 3077dfd2d02e710597f6b398a9b9c5bb0f797f6ad6c6013ef0e222d6c7b13bbd
- MD5 36f922a60f155a6f3559bdb5f85a2701
- SHA1 2f3b4b2dd7e66910288d3e932968b21544db8343
- SHA512 6567f10e5b426e55e83370593bd62046d63f8c020f83451f72fde08aee5f2f38f480fe1cba5312efd5bb863d81971f60cbd49ba31cf6dbcac55e7fd3cb84947f
- SSDEEP 1536:VI3/Ykf5P9Zq9ZvwsNiaoq+NhttKNFlB1YDMNNQdvqsIOHegtYV2py:VI3QkhPBhttKj1YDMNNQddHHtYVK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\apa.dll
- Size 221B
- SHA256 7a45df2b7128f24e56986db32feedd12694a34cdab9d86cede6f871fe1f9b3e0
- MD5 ff5f253c12dd8373c347b218fc46adf9
- SHA1 a42b85049849d001cb83ffab4cefc6edcb863613
- SHA512 ca3c5f36d07c75c41c174baaa9d077f336c666c55de7139eda8593f0e95f7d2fa63bde9578cd1defd5fd6f44e53266d0555fac86fd98c1eed00b04db5c845645
- MD5 SHA1 SHA512